4 ms·
If the device is a black box, you don't even need key exchanges though? You can just send encrypted data with a pre-configured, unique, randomly generated (for
by pingyong 7y ago
If the device is a black box, you don't even need key exchanges though? You can just send encrypted data with a pre-configured, unique, randomly generated (for the device) key to a hard-coded IP-address. And even if you don't want to use a hard-coded IP-address, there are about a million ways to have some sort of custom encrypted "address resolution" through IRC or whatever else. In fact you could also just send the data to some Tor node or even base64 encoded through IRC. And a million other ways. It's not like DoH is really going to make a difference here. I mean you can even just send pings with what seems like randomly generated payloads that actually contain encrypted data. Really not sure what DoH is supposed to change about that. All it does is make spying with zero effort very slightly more difficult to detect.
- tialaramex 7y agoIt's really common for "security" products to assume bad guys will meekly obey conventions like telling the truth. "Are you a bad guy?" "No". Ok then, test passed. Plenty of anti-TLS 1.3 stuff for example says that they "need" the plaintext Certificate message which in TLS 1.3 is now encrypted. But that message is literally just some public data - an X.509 certificate, if you're using it to "verify" anything your security is broken because a bad guy can send someone else's cert. They can't send a working CertificateVerify for it, but you don't know that because that message was never plaintext.